Network Security (8) Flashcards
Which of the following is the term for a network segment that is separated from the internal network by a firewall and exposed to the Internet?
AES
DMZ
VLAN
DMZ
A network segment that is separated from the internal network by a firewall and exposed to the Internet is called a demilitarized zone (DMZ), or a perimeter network. Administrators typically use a DMZ for servers that must be accessible by outside users, such as web and email servers. Advanced Encryption Standard (AES) is an encryption algorithm. A honeynet is a network designed to entice attackers that provides no meaningful access to sensitive information. A virtual LAN (VLAN) is a network created within a switch
Which of the following best describes the process of penetration testing?
Administrators attempt to access the network from outside using hacker tools.
An organization hires an outside consultant to evaluate the security conditions on the network.
An organization hires an outside consultant who attempts to compromise the network’s security measures.
An organization hires an outside consultant who attempts to compromise the network’s security measures.
Penetration testing is when an outside consultant is engaged to attempt an unauthorized access to protected network resources. Testing by an internal administrator familiar with the security barriers would not be a valid test. While having a consultant examine the network’s security from within can be useful, this is not a penetration test. Computers or networks that are alluring targets for intruders are called honeypots or honeynets
Which of the following are the default administrative user accounts found in Windows and Linux operating systems? (Choose all correct answers.)
Administrator
root
admin
Control
Administrator
root
Administrator is the default administrative user account in Windows, and root is the administrative account in Linux. Control and admin are not privileged user accounts provided with the operating systems
Which of the following are network segmentation methods that can prevent intruders from gaining full access to a network? (Choose all correct answers.)
ACL
VLAN
NAC
DMZ
VLAN
DMZ
Virtual LANs can be used to isolate systems on a separate network segment. A demilitarized zone (DMZ), also called a perimeter network, is a network segment accessible from the Internet and separated from the internal network by a firewall. Both of these are methods for isolating systems to prevent security breaches from spreading beyond their bounds. Access control lists (ACLs) and Network Access Control (NAC) are both methods for enhancing network security, but they are not segmentation methods
Which of the following types of mitigation techniques is not applicable to servers?
Role separation
File integrity monitoring
DHCP snooping
DHCP snooping
DHCP snooping is a feature found in some network switches that prevents rogue DHCP servers from assigning IP addresses to clients. It can also detect when DHCP release or decline messages arrive over a port other than the one on which the DHCP transaction originated. The other options are all techniques that are applicable to servers
On a wireless access point that uses an access control list (ACL) to specify which devices are permitted to connect to the network, which of the following is used to identify the authorized devices?
IP addresses
Device names
MAC addresses
MAC addresses
Wireless access points use the layer 2 MAC addresses coded into devices in their access control lists. Usernames, IP addresses, and device names can easily be impersonated
Which of the following network devices does not employ an access control lists to restrict access?
Routers
Hubs
Switches
Hubs
ACLs restrict access to network devices by filtering usernames, MAC addresses, IP addresses, or other criteria. Routers, switches, and wireless access points all use ACLs to control access to them. Hubs are purely physical layer devices that relay electrical or optical signals. They have no way of controlling access to them
Which of the following services are provided by access control lists (ACLs)?
Authentication
Authorization
Accounting
Authorization
ACLs define the type of access granted to authenticated users. This process is known as authorization. Authentication is the confirmation of a user’s identity. Accounting and auditing are both methods of tracking and recording a user’s activities on a network
Which of the following terms describes the threat mitigation technique of deploying individual applications and services on virtual servers so that no more than one is endangered at any one time, rather than deploying multiple applications on a single server?
Geofencing
Network segmentation
Role separation
Role separation
Role separation is the practice of creating a different virtual server for each server role or application. In addition to providing other benefits as well, this forces intruders to mount attacks on multiple servers to disable an entire network. Geofencing is a technique for limiting access to a wireless network. Network segmentation describes the process of creating multiple VLANs or deploying firewalls to isolate part of a network. VLAN hopping is a type of attack in which an intruder sends command messages to a switch to transfer a port from one VLAN to another
Role separation is a threat mitigation technique that is applied to which of the following types of network components?
Switches
Servers
Routers
Servers
Role separation is the practice of creating a different virtual server for each server role or application. In addition to providing other benefits as well, this forces intruders to mount attacks on multiple servers to disable an entire network. Switches, routers, and access points do not use this technique
Which of the following statements about DHCP snooping is not true?
DHCP snooping detects rogue DHCP servers.
DHCP snooping is implemented in network switches.
DHCP snooping prevents DNS cache poisoning.
DHCP snooping prevents DNS cache poisoning.
DHCP snooping is a feature found in some network switches that prevents rogue DHCP servers from assigning IP addresses to clients. It can also detect when DHCP release or decline messages arrive over a port other than the one on which the DHCP transaction originated. Although DHCP snooping can prevent DHCP clients from being assigned an incorrect IP address, it does not directly prevent the poisoning of DNS server caches with erroneous information
At which layer of the OSI reference model does DHCP snooping operate?
Data link
Network
Transport
Data link
Although DHCP is an application layer service, which uses the UDP transport layer protocol to assign network layer IP addresses, DHCP snooping is a data link layer process in which a network switch examines incoming DHCP traffic to determine whether it originates from an authorized server and is arriving over the correct port
Which of the following types of server attacks is a flood guard designed to prevent?
Evil twin
Denial of service
DNS poisoning
Denial of service
One of the most common ways to stop a server from functioning properly is to flood it with traffic of a particular type. Denial-of-service attacks frequently use floods of ping messages or TCP SYN packets to attack a server. A flood guard is a filter implemented in a firewall or a standalone device to prevent the flood of traffic from reaching the intended target. A flood guard cannot prevent an evil twin attack, which is a rogue wireless access point, DNS poisoning, which is the insertion of incorrect resource records into a DNS server cache; or war driving, which the process of searching for unprotected wireless networks
Which of the following types of attacks on a network switch can a flood guard help to prevent?
DNS poisoning
War driving
MAC flooding
MAC flooding
By flooding a switch with frames containing many different false MAC addresses, an attacker can cause the legitimate entries in the switch’s MAC table to be aged out of the device and replaced with bogus entries. When the destinations of incoming frames are not found in the table, the switch broadcasts them throughout the network, where they can be more readily captured and compromised. A flood guard is a mechanism that prevents confirmed MAC address in the table from being replaced. A flood guard in a switch cannot protect against DNS poisoning, war driving, or evil twin attacks
Which of the following protocols is a root guard designed to affect?
EAP
STP
LDAP
STP
A root guard affects the behavior of the Spanning Tree Protocol (STP) by enforcing the selection of root bridge ports on a switched network. Without root guards, there is no way for administrators to enforce the topology of a network with a redundant switching fabric. Root guards do not affect the Extensible Authentication Protocol (EAP), the Lightweight Directory Access Protocol (LDAP), or the Address Resolution Protocol (ARP)
